Fibre channel address blocking

Abstract

A method and system including apparatus for detecting and blocking an invalid request to a target wherein fibre channels interconnect the data processing configuration. A request made from a hub such as a fabric switch to an internal fibre channel arbitrated loop is blocked by substituting IDLE characters for the frames of data included with the request. The substitution of IDLE signals can also occur within an internal fibre channel arbitrated loop system where access is blocked to a confidential data storage system. If the request is legitimate, the data frames are passed to the target and the requested data is transmitted back to the requester. If the request is refused as being an unauthorized request, the data frames are replaced with IDLE characters and no transfer of confidential data occurs.

Description

BACKGROUND OF THE INVENTION [0001] 1. Technical Field [0002] The invention relates to fibre channel computer networks and more particularly to apparatus and method for preventing unwanted access to data at a target device when an invalid source address is detected. [0003] 2. Description of the Prior Art [0004] Fibre channel is a general name of a new protocol for flexible information transfer. The fibre channel provides a high speed transfer of large amounts of information while providing an interconnection for various interfaces such as central processing units and data storage devices. The fibre channel permits the transporting of multiple protocols over a common physical interface. The channel protocol refers to a peripheral input / output interface to a host computer that transports large amounts of data between the host computer and the peripheral device such as a data storage system. Data transfer is handled in hardware with little or no software involvement once an input / output...

AI Technical Summary

Benefits of technology

[0007] The invention provides a technique that permits network access to a storage device while monitoring the source address of the requester to determine whether the requester has been authorized to access the data. A blocking device is positioned between the fibre channel address target and the fabric switch controlling the connection of the source and the target. The blocker inspects all incoming frames of data. The blocker checks the source and destination addresses. If a frame of data is detected that is addressed to an unconfigured source / destination address peer, the frame has its data replaced with IDLE characters. The source could be a host computer requester with a private data storage device being the target. Likewise, the source could be the private data storage with the target being the host computer of the requester. With this invention, unauthorized data is prevented from being transported along the fibre channel while the integrity of the transmission of data is maintained by transporting IDLE characters instead of data frames of information.

[0008] The invention provides a number of distinct advantages. The present invention provides apparatus that is positioned in the fibre channel to block either an unauthorized access to private data or to prevent the unauthorized access to a user's network from external network addressing. The invention is unique in that the integrity of the fibre channel is not disturbed since the data frames are replaced by IDLE characters and thereby the transmission along the fibre channel is not interrupted. In the method of the invention, the destination target address is compared to an allowed list of addresses. If a valid comparison is made, the data frame is passed along the fibre channel. If there is no comparison, as would be the case for an unauthorized access, the data frames are converted to IDLE characters and transmitted down the fibre channel. The blocking apparatus of this invention can be positioned to prevent unauthorized access to either a private data source or the entire private user's network.

[0010] Another object of the present invention is to provide a means and a process to prevent unauthorized access to data through a fibre channel.

[0011] Still another object of the present invention is to provide apparatus and an article of manufacture that maintains the integrity of the fibre channel by replacing the data frames with IDLE characters and thereby continuing the data flow along the channel.

Problems solved by technology

This becomes a problem when one user wants to protect its private data from access from the remainder of the network.

Thus, unauthorized requests for private data can be made from anyone of the multiple requesters connected to a fibre channel.

Images